Rule Library
Sigma Rules
3 rules found for "David ANDRE (additional keywords)"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
Mimikatz Use
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Windows
Florian Roth (Nextron Systems)+1Tue Jan 10windows
Detectionhightest
HackTool - Mimikatz Execution
Detection well-known mimikatz command line arguments
WindowsProcess Creation
Teymur Kheirkhabarov+3Tue Oct 22windows
Detectionhightest
Suspicious SYSTEM User Process Creation
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
WindowsProcess Creation
Florian Roth (Nextron Systems)+1Mon Dec 20windows